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Abstract. In the following paper we present a new semantics for the 
well-known strategic logic ATL. It is based on adding roles to concurrent 
game structures, that is at every state, each agent belongs to exactly 
one role, and the role specifies what actions are available to him at that 
state. We show advantages of the new semantics, analyze model checking 
complexity and prove equivalence between standard ATL semantics and 
our new approach. 

1 Introduction 

One of the most intensively studied |8)9|16j areas of research in the field of 
multi-agent systems are strategic or cooperation logics - formalisms that allow 
for reasoning about agents' strategies and behavior in a multi-agent setting. Two 
of the most known logics are Marc Pauly's Coalition Logic (cl) |10lllj and Alur, 
Henzinger and Kupferman's Alternating-time Temporal Logic (atl) [S], which 
can be considered a temporal extension of Coalition Logic. Both these logics 
gained much popularity and generated a 'zoo' of derivatives |15)13)l|3l2] . 

This popularity is in no small part due to relative high expressive power of 
both CL and ATL, but also due to low complexity of model checking problems 
for these respective logics. Model checking of Coalition Logic can be solved in 
polynomial time in the size of the model and the length of the formula lOJ. It 
remains polynomial for ATL as well [5J, which is considered a very good result. 
However, as investigated by Jamroga and Dix )7|, in both cases the number 
of agents must be fixed. If it is not then model checking of ATL models repre- 
sented as alternating transition systems is NP-complete, and if the models are 
represented as concurrent game structures (CGS) it becomes Zj-complete. Also, 
van der Hoek, Lomuscio and Wooldridge show [14 that complexity of model 
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checking for ATL is sensitive to model representation. It is polynomial only if 
an explicit enumeration of all components of the model is assumed. For models 
represented in a (simplified) reactive modules language (rml) [4 complexity of 
model checking for ATL becomes as hard as the satisfiability problem for this 
logic, namely EXPTIME [Ti] . 

We present an alternative semantics that interprets formulas of ordinary ATL 
over concurrent game structures with roles. As we describe in Section [2.1[ such 
structures introduce an extra element ~ a set R of roles. Agents belonging to 
the same role are considered homogeneous in the sense that all consequences of 
their actions are captured by considering only the number of votes an action 
gets (one vote per agent). We give some examples that motivate our approach 
and prove equivalence with ATL based on concurrent game structures. We then 
discuss model checking, showing it to be of polynomial complexity in the size of 
models. This seems significant, since as long as the number of roles remain fixed, 
the size of our models does not grow exponentially in the number of players. 

The structure of our paper is as follows. We present a revised formalism for 
ATL in Section [2] prove equivalence with the standard one in Section [3j discuss 
model checking results in Section [4] and conclude in Section [5] 

2 Role-based semantics for ATL 

The language of ordinary ATL is the following, as presented in [5]: 

p I -0 U A I O I I m4i^<f> 

where p is propositional letter, and A is a coalition of agents. We follow standard 
abbreviations (e.g. (( )) for ((0))) and skip connectives that are derivable. 

2.1 Concurrent Game Structures with Roles 

In this section we will introduce concurrent game structures with roles (rcgs) 
and consider some examples. We will be using the notation [n] — {l,...,n}, 
and we will let denote the set of functions from B to A. We will often work 
with tuples V — {vi, . . . , u„) and we will often view w as a function with domain 
[n] and write v{i) for Uj. We will do addition and subtraction on tuples of the 
same arity component by component, e.g. for w = {vi, . . . , Vn), v' — {v[, . . . , t;^), 
V — v' = {vi — v[, . . . ,Vn — v'j^). Given a function f : A x B ^ C and a € A, 
we will use fa to denote the function B ^ C defined by fa{b) = f{a, b) for all 
be B. 

Definition 2.1. An RCGS is a tuple H = {A, R,TZ,Q, n,7r, A,S) where: 

— A is a non-empty set of players. In this text we assume A = [n] for some 
n Cz N, and we will reserve n to mean the number of agents. 

— Q is the non-empty set of states. 

— R is a non-empty set of roles. In this text we assume R — [i] for some z G N. 



— 7?. : Q X i? — > p{A), such that for every q Cz Q we have 

• For all r, r' e R, if r ^ r' then n{q, r) n 7^(g, r') = 

For a coalition A (- A we write Ar_q for the agents in A which belong to role 
r at q, i.e. Aj-^q — TZ{q, r) f] A. 

— n is a set of prepositional letters and n : Q ^ p{n) maps states to the 
propositions true at that state. 

— A : Q X R ^ is the number of available actions in a given state for a 
given role. 

— For A = [n] = {1, . . . n}, we say that the set of complete votes for a role r in 



a state q is Vr{q) = {vr,q e [n] | Ei<a<A(g,r) ■'^'■,9(") = 



set of functions from the available actions to the number of agents performing 
the action. The functions in this set account for the actions of all the agents. 
The set of complete profiles at q is P{q) = YireR ^ril)- For each q £ Q we 
have a transition function at q, Sq : P{q) — > Q defining a partial function 



S:Qx U„gQ P{q) -> Q such that for allqeQ, Pe P{q), S{q, P) = 5q{P) 



To illustrate how RCGS differs from an ordinary concurrent game structure, we 
provide some examples. 

Example 2.1. We construct an example similar to the well-known train-controller 
scenario [5], but in contrast to the original, in our scenario there are rtj trains. 
Consider a turn-based synchronous game structure with roles Strain — (-4, 
R,TZ,Q,n,n,A,S) where: 

— A = {1, ■ . . ,nt,nt + 1}. There are nt trains and one controller. 

— i? = {train, ctr}. There are two roles: one for trains and one for the con- 
troller. 

— Q = {90, 91,92, gs}- 

— Ti{qi, train) = [nt], and TZ{qi,ctr) — {nt + 1}, for all qi G Q. 

— n = {out-of -gate, in_gate, request, grant} 

~ ■"■(90) = {out_of _gate}, 7r(gi) — {out _o f _gate, request}, 
7r(92) — {out _o f _gate, grant}, 7r(q3) = {in^gate}. 

— A{qQ, train) ~ 2, A{qQ,ctr) — 1, A{qi, train) = 1, A{qi,ctr) = 3, 
A{q2, train) — 2, A{q2,ctr) = 1, A{q3, train) — 1, A{q^,ctr) = 2. 

— and finally 



d{qo, ((0, ut), 1)) - S{q,, {nt, (1, 0, 0))) = 6{q2, ((0, nt), 1)) 



= ^(93, {{a,nt - a),l)) = qo 
5{qo, {{a, nt - a), 1)) = S{qi, {nt, ((0, 1, 0)))) = qi 
S{qi, {nt, (0, 0, 1))) = ^(^2, ((a, nt - a), 1)) = 92 
5{q2, ((1, nt - 1), 1)) - S{q3, ((0, nt), 1)) = 93 



where 1 < a < Tif 
where 1 < a < Tif 
where 2 < a < nt 



Figure [T] presents the example in a visual way. The model can be seen as a 
generalization of the classical train-controller example. In go we stay in qo unless 



at least one train issues a request. In qi the controller behaves as before; it can 
postpone making a decision (staying in qi), reject all requests (going to qo), or 
accept the requests (going to (72)- In 92 the trains can choose to enter the tunnel, 
but only one of them may do so; if nobody attempts to enter the grant is revoked 
(or relinquished), if more than one train attempts to enter we stay in (72, and 
finally if (the trains reach an agreement and) only one train enters we go to q^ . In 
93 any train may decide that the train in the tunnel has to leave (returning to go), 
and the train in the tunnel must comply. This reflects the homogeneity among 
players in the trains role. The action of deciding to leave the tunnel is shared 
among all trains, and the train actually in the tunnel remains unidentified. 



request- 




Fig. 1. Train controller model for nt trains (similar to the one presented in [5]). 



Notice that in the single-train case {nt = 1), the train can not wait before 
entering the tunnel after being granted permission (and retain the permission). 
This could of course easily be avoided by adding another action. More impor- 
tantly, in the case of several trains, the controller can not distinguish between 
the different trains, so permission must be granted to all or none. This is a 
consequence of the strict homogeneity in the model: not only are the agents 
homogeneous in terms of the actions available to them, we can not reasonably 
distinguish between them as long as they remain in the same role. Notice that 
this feature allow us to add any number of trains to the scenario without in- 
curring more than a linear increase in the size of the model (total number of 
profiles). This would not be possible if we did not have roles. If the model above 



was to be rendered as a concurrent game structure, the number of possible ways 
in which trains could act would be exponential in all states where trains have to 
make a choice of what action to perform. This would be the case even if, as in 
the scenario above, almost all possible combinations of choices should be treated 
in the same way by the system. 

Sometimes homogeneity is desirable. In our trains and controller example, 
for instance, homogeneity strongly encourages cooperation among trains; no one 
can enter the gate unless everyone agree, and everyone knows that whoever gets 
to enter must leave as soon as he is asked to. On the other hand, we notice that 
it is impossible for any train to enter the gate unless all trains cooperate. This 
might be overly restrictive. By adding more roles, however, we can amend this 
while still retaining many of the benefits of using roles. 

Example 2.2. In the previous example all trains were equal before the controller; 
the controller could not distinguish between trains. We could grant the agents 
much more individual identity by simply adding one more role, and in this 
example we sketch the result of doing so. First we make rit "copies" of the 
previous model sharing the state go- In Figure[2]wc illustrate the resulting model 
for nt — 3. In qq we let the trains vote for which train should be allowed to 
request permission to enter the tunnel. We assume majority voting, but we do 
not resolve ties. It means that if one train, x, gets more votes then all others we 
go to "his" state, qix. Otherwise we just loop on go- If we get to a gi-state, the 
controller can grant or reject the request. Contrary to the previous example the 
controller now knows which train is being proposed. If the controller grants the 
request, the selected train is put in a privileged role and given the sole choice of 
what to do with the permission. 

The model has grown, so the trains gain autonomy at a cost. Still, this cost 
is much less than the cost of modelling this scenario in a CGS. There, if each 
train is to have the option to "vote" for any train in go, each train must have 
nt actions available. We would get n"* edges leading out from go! In the RCGS 
model we get a substantially smaller degree, the following table summarizes the 
difference (formulas for counting the degree are explained and discussed further 
in section [4| 



Before we move on we introduce some more notation. Given a role r G i?, 
a state g and a coalition A, the set of A- votes for r at g is Vr{q,A), defined as 
follows: 



nt:3 4 5 



6 



n 



CGS: 27 256 3125 46656 . . . 
RCGS: 10 35 127 462 . . . 



(2n-l)! 
n!(n-l)! 





Fig. 2. The "autonomous trains" model for rit — 3. Numbers in red indicate member- 
ship in roles: (1) = 0, {ctr}) , (2) = {A\{a} , {a} , {ctr}) , (3) = {A\{b},{b},{ctr}), 
(4) = \ {c}, {c}, {ctr}}. Also, each qi state has a transition pointing at go labeled 
(3, 0, (1, 0, 0)) that was omitted from the picture for the sake of clarity. 

The yl-votes for r at g gives the possible ways agents in A that are in role r at g 
can vote. Given a state q and a coalition A, we define the set of A-profiles at q: 

P{q,A)^{{vi,...,viRi) \ l<i<\R\:v,eVriq,A)} 

When we say that a function v : [A{q, r)] — > [n] is a complete vote (for r at q), we 
mean that v € Vr{q,A). For any v G Vr{q,A) and w G Vr{q,B) we write v < w 

iff for all i € [A((7,r)] we have v{i) < w{i). li v < w, we say that w extends v. 
If F ^ (vi,...,vr) e P{q, A) and F' = {v[, ...,v'r) e P{q, B) with Vi < v', for 
every 1 < « < |i?|, we say that F < F' and that F extends F' . 

An A profile F e P((?, A) is a complete profile iff the sum of its components 

equal \A\, i.e. F e P{q) iff (Y.r<\R\ EaeA(,.r) = l-^l iff A = ^. Given a 

(partial) profile F' at a state g we write ext{q, F) for the set of all complete 
profiles that extend F' . 

Given two states q^q' € Q, we say that q' is a successor of (? if there is 
some F e P^q) such that 5((7, i^) = q' . A computation is an infinite sequence 
A = qoqi ■ ■ ■ of states such that for all positions i > 0, qi+i is a successor of qi. We 
follow the standard abbreviations, hence g-computation denotes a computation 
starting at q, and X[i], A[0,i] and A[i,cx3] denote the i-th state, the finite prefix 



5o9i ■ ■ ■ Qi and the infinite suffix qiqi+i ... of A for any computation A and its 
position i > 0. An A-strategy for A C ^ is a function : Q — > Ugeg P{^^ ^) 
such that SA{q) G P{q,A) for all q E Q. That is, sa maps states to A-profiles 
at that state. The set of all A-strategies is denoted by strat{A). If s is an A- 
strategy and we apply Sq to s{q), we obtain a unique new state q' — Sq{s{q)). 
Iterating, we get the induced computation Ag.q — q^qi ■ ■ ■ such that q — qo and 
Vz > : Sq.(s{qi)) — qi+i- Given two strategies s and s' , we say that s < s' iS 
Vq E Q : s{q) < s'{q). Given an A-strategy sa and a state q we get an associated 
set of computations out(sA, q)- This is the set of all computations that can result 
when at any state, the players in A are voting in the way specified by sa- 
out{sA, q) — {As.g I s is an A-strategy and s > sa} It will also be useful to have 
access to the set of states that can result in the next step when A C A follows 
strategy sa at state g, succ{q, sa) — {q' & Q \ 3F G ext{q,SA) ■ S{q,F) = q'}. 
Clearly, q' E succ{q, sa) iff there is some A E out{q, sa) such that q' = -^[0]. 

2.2 New Semantics for ATL 

Definition 2.2. Given a RCGS S and a state q in S , we define the satisfaction 
relation |= inductively: 

S,q\^piffpe TT{q) 

S, q \=^<j> iff not S,q\=(j) 

S, q 1=0 A 0' iff S,q\= (j) o.iT'd S,q \= ip' 

S, q Q 4> iff there is sa G strat{A) such that 

for all A E out{sA, q), we have S, A[l] |= cf) 
S,q \={{A))D(f) iff there is sa E strat{A) such that 

for all A E out(sA, q) we have S, X[i] \^ (f) for all i > 
S,q \={{A))(I>U4>' iff there is sa E strat{A) such that 

for all A E out{sA, q) we have X[i] ^ (/)' and S, X[j] \— 4> 

for some i > and for all < j < i 

3 Equivalence between RCGS and CGS 

In this section we show that definition |2.2| provides an equivalent semantics for 
ATL. We do this by first giving a surjective function / that takes an RCGS and 
returns a CGS. Then we show that S and f{S) satisfy the same ATL formulas. 

Remember that a concurrent game structure is a tuple {A,Q,n,TT,d,6') 
where every element is defined as for an RCGS except d : A x Q that 
maps agents and states to actions available at that state, and 6' that is a partial 
function from states and action tuples to states defined by 6'{q, t) = S'q{t) where 
^'q ■ YlaeAi'^o-^l)] — > Q is a transition function at q based on tuples of actions 



rather than profiles. The satisfaction relation for ATL based on CGSs can be de- 
fined exactly as in definition |2.2[ the difference concerning only what counts as 
a strategy. 

We refer to elements of Ilae^MiC?)] as complete action tuples at q. A (memory- 
less) strategy ior a E A in a CGS M is a function Sa : Q — > N+ such that for all 
q £ Q, Sa{q) e [^0(9)] while a strategy for A C is a list of strategies for all 
agents in A, sa = (sai, Saa, ■ • ■ , Sa,^,), for A = {ai, a2, . . . ,a\A\}- We denote the 
set of strategies for A C ^ by strat{A). When needed to distinguish between 
different structures we write strat{S, A) to indicate that we are talking about 
the set of strategies for A in S. 

We say that a complete action tuple at q, t = {ia-^ , ■ ■ ■ , ia„) extends a strategy 
SA G strat{A) if for all aj g A we have ia = Sa (q)- We denote the set of all 
complete action tuples at q extending sa by ext{q, sa)- For any state q G Q we 
have the set of all computations that comply with sa'- 

out{q, sa) ={A = go9i92 ■ ■ • 

\ q — qQ and for alH G N : 3t G ext{qi, sa), 5{q,t) = qi+i} 

We define the set of Syi-successors at g € Q: 

succ{q, sa) = {(?' e Q I 3t G ext{q, sa), S{q, t) = q'} 

When we need to make clear which structure we are talking about, we write 
succ{S, q, sa)- Observe that q' G succ{q, sa) iff q' = for some A € out{q, sa)- 
The translation function / from RCGS to CGS is defined as follows: 

f{A, R, n, Q, 77, TT, A, ,5) = {A, Q, 77, tt, d, 6') 

where: 

da{q) = A(g, r) where a G TZ{q, r) 

5' {q, ai, . . . ; Un) = 5{q, wi, . . . , where for each role r 

Vr = {\{i£n{q,r) I a, = l}|,...,|{^e7^((Z,r) | a,^K{q,r))\) 

We can see straight away that / is surjective because for any CGS S" with n 
agents we could define a RCGS S with that many roles where each role contains 
exactly one agent. A vote for a role r, Vr, at q would then simply be a da{q)-twple 
consisting of a single 1 (representing the agents chosen action) and otherwise 
zeros. It is easy to verify that f{S) — S' . 

Given either a CGS or an RCGS S, we define the set of sets of states that 
a coalition A can enforce in the next state of the game: 

force{S, q, A) = {succ{q, sa) | Syi is a strategy for A in S}. 

The first thing we do towards showing equivalence is to describe a surjective 
function m : strat{f{S)) — > strat{S) mapping action tuples and strategies of 



f{S) to profiles and strategies of S respectively. For all A C A and any action 
tuple for A at g, ~ {aai,aa2i ■■■i'^a^A\) with 1 < < daii<l) for all 1 < i < 
\A\, the ^-profile m{tq) is defined in the following way: 

m{tq) = {v{tq, 1), . . . , v{tq, \R\)) whcrc for all 1 < r < \R\ we have 
^'(^9: r) = (|{a e Ar^q I tta = 1}|, . . . , |{a e A^^g | = A(g, r)}|) 

Thus the i-th component of v{tq, r) will be the number of agents from A in 
role r at q that perform action i. 

Given a strategy sa in /(S) we define the strategy to(sa) for S by taking 
m{sA)iq) = m{sA{q)) for all q £ Q. 

Surjectivity of m is helpful since it means that for every possible strategy that 
exists in the RCGS 5*, there is a corresponding one in f{S). This in turn means 
that when we quantify over strategies in one of S and f{S) we are implicitly also 
quantifying over strategies in the other. Showing equivalence, then, can be done 
by showing that these corresponding strategies have the same strength. Before 
we proceed, we give a proof of surjectivity of m. 

Lemma 3.1. For any RCGS S and any A C A, the function m : strat{f(S), A) — >■ 
strat{S, A) is surjective 

Proof. Let pA be some strategy for A in S. We must show there is a strategy sa 
in f{S) such that m{sA) = Pa- For all q G Q,we must define SAiq) appropriately. 
Consider the profile pa(<z) = ■ ■ ■ ,v\r\) and note that by definition of a profile, 
all Vr for 1 < r < \R\ are A-votes for r and that by definition of an A-vote, we 
have X]i<i<A(9 r) ^'•(i) — \^r,q\- Also, for all agents a, a' G Aj.^q we know, by 
definition of /, that da{q) = da'{q) = A(g,r). 

From this it follows that there are functions a : A — >■ N"*" such that for all 
a £ A, a{a) G [daiq)] and \{a S Ar^q \ a{a) — i}\ — Vr{i) for all 1 < z < A(g,r), 
i.e. 

Vr = {\{a e Ar^q\a{a) = 1}|, . . . , |{a e Ar.q\a{a) ^ A{q, r)}\) 

We choose some such a and sa = ■ • • , o:{o-\a\))- Having defined sa in this 

way, it is clear that m(s^) = pA- 

Using the surjective function m we can prove the following lemma, showing 
that the "next time" strength of any coalition A is the same in S as it is in f{S). 

Lemma 3.2. For any RCGS S , any state q (z Q and any coalition A Q A, we 
have force{S,A,q) = force{f{S),A,q) 

Proof. By definition of force and lemma |3.1| it is sufficient to show that for all 
Sa S strat{f{S), A), we have succ{S,m{sA),q) = succ{f{S),SA,q). We show 
C as follows: Assume that q' G force{S,m{sA),q)- Then there is some com- 
plete profile P = {vi, . . . , v\ii\), extending m(s^)(g), such that 6{q, P) — q' . Let 



m{sA){q) = {wi,... , W|_R|) and form P' ^ {v[, . . . ,v'^j^^) defined by v[ ^ Vi - Wi 
for all 1 < i < \R\. Then each v'l is an \ A)-vote for role i, meaning that 
the sum of entries in the tuple is \{A\ A)j,.q\. This means that we can de- 
fine a function a : A ^ N+ such that for all a £ A, a{a) S [da(q)] and for 
all a G A, a{a) = Sa{q) and for every r £ R and every a £ {A \ A), and 
every 1 < j < k{q,r), \{a £ {A \ A)r,q \ a{a) = j}\ = v'^{j). Having de- 
fined a like this it follows by definition of m that for all 1 < j < A{q,r), 
\{a £ Ar^q I a{a) = j}\ = Wr{j). Then for all r £ R and ah 1 < j < A{q,r) 
we have \{a £ TZ{q,r) \ a{a) ~ j}\ = Vr{j)- By definition of f{S) it follows 
that q' = S{q,P) — S'{q,a) so that q' £ force{f{S),SA,q)- We conclude that 
force{S,f{sA),q) C force{f{S),SA,q)- The direction ^ follows easily from the 
definitions of m and /. 

Given a structure S (with or without roles), and a formula (j), we define 
true{S,(j)) = {q £ Q \ S,q \^ 4>\. Equivalence of models S and f{S) is now 
demonstrated by showing that the equivalence in next time strength established 



in lemma 3.2 suffices to conclude that true{S, (j)) = true{f {S) , (f) for all 4>- 



Theorem 3.1. For any RCGS S, any (f> and any q £ Q, we have S,q \^ 4> iff 
f{S),q \=CGS <P 

Proof . We prove the theorem by showing that for all we have true{S, (j)) = 
true{f {S) , (f)) . We use induction on complexity of (j). The base case for atomic 
formulas and the inductive steps for Boolean connectives are trivial, while the 
case of ((A)) Q) (j) is a straightforward application of lemma |3.2[ For the cases 
of ((A))n0 and {{A))(fiy{ip we rely on the following fixed point characterizations, 
which are well-known to hold for ATL, see for instance [6], and are also easily 
verified against definition |2.2| 



((A))n0o0A((A))OP)>n0 

{{A))(f>iUc^2 ^ 02 V {(Pi A {{A)) O {{A))^iU(j)2 ^ ' 

We show the induction step for ((A))n0, taking as induction hypothesis true{S, (f>) 
true{f{S), 4>). The first equivalence above identifies Q' — true{S, {{A))D(j>) as the 
maximal subset of Q such that ip is true at every state in Q' and such that A 
can enforce a state in Q' from every state in Q' , i.e. such that Vq £ Q' : 3Q" £ 
force{q,A) : Q" C Q' . Notice that a unique such set always exists. This is 
clear since the union of two sets satisfying the two requirements will itself sat- 
isfy them (possibly the empty set). The first requirement, namely that (jj is true 
at all states in Q' , holds for S iff if holds for f{S) by induction hypothesis. 



Lemma 3.2 states force{S,q,A) = force{f{S),q, A), and this implies that also 
the second requirement holds in S iff it holds in f{S). From this we conclude 
true{S, {{A))n(l)) = true{f{S), ((A))n0) as desired. The case for {{A))(fiA'iJj is sim- 
ilar, using the second equivalence. □ 



4 Model checking and the size of models 



(-+(-^)y- < a" , < (2) 



We have already seen that using roles can lead to a dramatic decrease in the 
size of ATL-models. In this section we give a more formal account, first by inves- 
tigating the size of models in terms of the number of roles, players and actions, 
then by an analysis of model checking ATL over concurrent game structures with 
roles. 

Given a set of numbers [a] and a number n, it is a well-known combinatorial 
fact that the number of ways in which to choose n elements from [a] , allowing 
repetitions, is ^"j^l^a~i)\ • Furthermore, this number satisfies the following two 
inequalities]^ 

{rt 

,!(a-l)! — " ' n!(a-l)! 

These two inequalities provide us with an upper bound on the size of RCGS 
models that makes it easy to compare their sizes to that of CGS models. Typically, 
the size of concurrent game structures is dominated by the size of the domain of 
the transition function. For an RCGS and a given state <? G Q this is the number 
of complete profiles at q. To measure it, remember that every complete profile 
is an |i?|-tuple of votes Vr, one for each role r G R. It follows that is 
the set of all possible combinations of votes for each role. Also remember that 
a vote Vr for r G i? is an A(g,r)-tuple such that the sum of entries is |7?.((7,r)|. 
Equivalently, the vote v,. can be seen as the number of ways in which we can 
make \Tl{q,r)\ choices, allowing repetitions, from a set of A(q,r) alternatives. 
Looking at it this way, we obtain: 

ip. ^, TT (|7^(g,r)| + (A(g,r)-l))! 
I ^'^^1 li |7^(g,r)|!(A(g,r)-l))! 

We sum over all g G Q to obtain what we consider to be the size of an RCGS 
S. In light of equation [2j it follows that the size of S is upper bounded by both 
of the following expressions. 

0{ E,eQ UreR \n<l, rr^''-^) , 0( E,eQ UreR Mq, ^'^^^'''^I) (3) 

We observe that growth in the size of models is polynomial in a = maXq^Q^re q) 
if n = A and \R\ is fixed, and polynomial in p = maXq^Q^reR\T^{QT''')\ if and 
\R\ are fixed. This identifies a significant potential advantage arising from intro- 
ducing roles to the semantics of ATL. The size of a CGS M, when measured in the 
same way, replacing complete profiles at q by complete action tuples at q, grows 
exponentially in the players whenever da{q) > 1 for each player a. We stress that 
we are not just counting the number of transitions in our models differently. We 
do have an additional parameter, the roles, but this is a genuinely new seman- 
tic construct that gives rise to genuinely different semantic structures. We show 



If this is not clear, remember that n" and a" are the number of functions [n] and 
[o]'"' respectively. It should not be hard to see that all ways in which to choose n 
elements from a induce non-intersecting sets of functions of both types 



that it is possible to use them to give the semantics of ATL, but this does not 
mean that there is not more to be said about them. Particularly crucial is the 
question of model checking over RCGS models. 



4.1 Model checking using roles 

For strategic logics, checking satisfiability is usually non-tractable, and the ques- 
tion of model checking is often crucial in assessing the usefulness of different 
logics. For ATL there is a well known "standard" algorithm, see e.g. [51. It does 
model checking in time linear in the length of the formula and the size of the 
model. The algorithm is based on the fixed point equation [T] from the proof 



of Theorem 3.1 so it will work also when model checking RCGS models. It is 
not clear, however, how the high level description should be implemented and, 
crucially, what the complexity will be in terms of the new parameters that arise. 

Given a structure with roles, S, and a formula 0, the standard model checking 
algorithm returns the set true{S, (/>), proceeding as detailed in algorithms [l] and 

m 



Algorithm 1 mcheck{S, (f) 
if <j) = p £ n then 

return tt{p) 
if (p = -^tj} then 

return Q \ mcheck{S, ip) 
if (j} = tp Alp' then 

return mcheck{S, tp) n mcheck{S, ip') 
if <P= {{A)) O then 

return {g j enforce{S, q, A,mcheck{S,tp))} 
if (P= {{A))Dtp then 

Qi := Q, Q2 mcheck{S , 'tp) 
while Qi g (52 do 

Qi ■■= Q2, Q2 ■■= {q e Q \ enforce{S, A, g, Q2)} n Q2 
return Qi 
if cp= {{A}}^pU^p' then 

Qi := 0, Q2 = mcheck{S,ip), Qg — mcheck{S,4>') 
while Qz g Q\ do 

Qi := Qi U Qs, Q3--{qeQ\ enforce{S, A, q, Qi)} R Q2 
return Qa 



Given a structure S, a coalition A, a state q & Q and a set of states Q', 
the method enforce answers true or false depending on whether or not A can 
enforce Q' from q. That is, it tells us if at q there is Q" € force{q, A) such that 
Q" C Q'. Given a fixed length formula and a fixed number of states, this step 
dominates the running time of mcheck (algorithm IT]). It is also the only part of 



the standard algorithm that behaves in a different way after addition of roles to 
the structures. It involves the following stepsF] 



Algorithm 2 enforce{S,A,q,Q') 
for F G P{q, A) do 
p = true 

for F' e ext{q, F) do 
if 5{q,F') ^ Q' then 
p = false 
if p = true then 
return true 
return false 



For all profiles F G P(q, A) the algorithm runs through all complete profiles 
F' G P{q) that extend F. Over CGSs, given a coalition A and two action tuples 
t= (aai,Q;a2,---,aa|^|),t' = (a^^,a^2, . . . ,q;^|^|) format q, the sets of complete 
action tuples that extend t and t' respectively do not intersect. It follows that 
running through all such extensions for all possible action tuples for A at g is at 
most linear in the total number of complete action tuples at q. This is no longer 
the case for RCGS models. Given two profiles P, P' for A at (7, there can be many 
shared extensions. In fact, P and P' can share exponentially many in terms of 
the number of players and actions available]^ So, in general, running enforce 
requires us to make several passes through the set of all complete profiles, and the 
complexity is no longer linear. Still, it is polynomial in the number of complete 
profiles, since for any coalition A and state q we have \P{q, A)\ < \P{q)\, meaning 
that the complexity of enforce is upper bounded by |P(g)p. It follows that model 
checking of ATL over concurrent game structures with roles is polynomial in the 
size of the model. We summarize this result. 

Proposition 4.1. Given a CGS S and a formula (j), mcheck[S , cj)) takes time 
0{le^) where I is the length of cj) and e = ^ P{q) the total number of tran- 

sitions in S 

Since model checking ATL over CGSs takes only linear time, 0{le), adding 
roles apparently makes model checking harder. On the other hand, the size of 

^ In implementations one would seek to take advantage of information collected by 
repeating calls to enforce and not just do a Boolean check for every new instance 
in the way we do it here. This aspect is not crucial for our analysis, so we do not 
address it further 

® To see this, consider P = {vi,V2 . . . ,v\fj\) and P' = {v'i,v'2, . . . ,^^1^1). Each Vr,v'^ G 
Va(?, sums to 'S'i<j<A(q,r)fiO) ~ 1^9. ' l- Thcu form a complete profile P" = 
(u", W2 , . . . , at q such that for all 1 < r < \R\ and all 1 < j < A{q,r) we 
have v"{j) = max{vr{j),vl.{j)). Then, if it exists, choose a coalition A' such that 
\A'^q\ — X'i<j<A(5,r)w"0)- It is clear that the number of complete profiles that 
extends both v and v' is equal to the number of all A \ A'-profiles at q. 



CGS models can be bigger by an exponential factor, making model checking much 
easier after adding roles. In light of the bounds we have on the size of models, 
c.f. equation [3] we find that as long as the roles and the actions remain fixed, 
complexity of model checking is only polynomial in the number of agents. This 
is a potentially significant argument in favor of roles. 

In practice, however, finding an optimal RCGS for a given CGS model M might 
be at least as difficult as model checking on M directly. It involves identifying the 
structure from f^{M) that has the minimum number of roles. In general, one 
cannot expect this task to have sub-linear complexity in the size of AfQ Roles 
should be used at the modelling stage, as they give the modeller an opportunity 
for exploiting homogeneity in the system under consideration. We think that 
it is reasonable to hypothesize that in practice, most large scale systems that 
lends themselves well to modelling by ATL do so precisely because they exhibit 
significant homogeneity. If not, identifying an accurate ATL model of the system, 
and model checking it, seems unlikely to be tractable at all. 

The question arises as to whether or not using an RCGS is always the best 
choice, or if there are situations when the losses incurred in the complexity of 
model checking outweigh the gains we make in terms of the size of models. A 
general investigation of this in terms of how fixing or bounding the number of 
roles affect membership in complexity classes is left for future work. Here, we 
conclude with the following proposition which states that as long we use the 
standard algorithm, model checking any CGS M can be done at least as quickly 
by model checking an arbitrary S G f^{M). 



Proposition 4.2. Given any CGS -model M and any formula (j) , let c{mcheck{M , (j))) 
denote the complexity of running mcheck(M , (p). We have, for all S G f~{M), 
that complexity of running mcheck{S, (j)) is 0{c{mcheck{M, cj))) 



Proof. It is clear that for any S G f^ (AI), running mcheck{S , (p) and mcheck(M , </)), 
a difference in overall complexity can arise only from a difference in the com- 
plexity of enforce. So we compare the complexity of enforce{S,A,q,Q") and 
enforce{M, A, q, Q") for some arbitrary q £ Q, Q" C Q. The complexity in both 
cases involves passing through all complete extensions of all strategies for A at 
q. The sizes of these sets are can be compared as follows, the first inequality is 
an instance of equation [2] and the equalities follow from definition of / and the 



Although in many practical cases, when models are given in some compressed form, 
the situation might be such that it is possible. The question of how to efficiently find 
small RCGS-models will be investigated in future work. 



fact that M ^ f{S). 

^ / (|A,.,| + (A(r,g)-l))! 
11 \Ar,,\liA{r,q)-l)\ 



TT f mir,q)\-\Ar,,\) + {A{r,q)-l 
11 {\n{r,q)\-\Ar,MHr,q)-l) 



))! 



< 



n n n n ^(^''^) 

jaeA aeA\A I aeA 



We started with the number of profiles (transitions) we need to inspect when 
running enforce on S at q, and ended with the number of action tuples (transi- 
tions) we need to inspect when running enforce on M = f{S). Since we showed 
the first to be smaller or equal to the latter and the execution of all other ele- 
ments of mcheck are identical between S and M, the claim follows. 



5 Conclusions, related and future work 

In this paper we have described a new type of semantics for the strategic logic 
ATL. We have provided motivational examples and argued that although in prin- 
ciple model checking ATL interpreted over concurrent game structures with roles 
is harder than the standard approach, it is still polynomial and generates ex- 
ponentially smaller models. We believe this provides conclusive evidence that 
concurrent game structures with roles are an interesting semantics for ATL, and 
should be investigated further. 

Relating our work to ideas already present in the literature we find it some- 
what similar to the concept of exploiting symmetry in model checking, as inves- 
tigated by Sistla and Godefroid [T^. Our approach is however different, since we 
we only look at agent symmetries in ATL. When it comes to work related directly 
to strategic logics, we find no similar ideas present, hence concluding that our 
approach is indeed novel. 

For future work we plan on investigating the homogeneous aspect of our 
'roles' in more depth. We are currently working on a derivative of ATL with 
a different language that will fully exploit the role based semantics. 
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